Skip to content

Commit 7c224c8

Browse files
damienboddamienbod
authored
Merge pull request #104 from damienbod/update/azure-certificate-management
Azure Key Vault management update
2 parents ae3f215 + cc467db commit 7c224c8

9 files changed

Lines changed: 135 additions & 108 deletions

File tree

‎Changelog.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22

33
[Readme](https://github.com/damienbod/IdentityServer4AspNetCoreIdentityTemplate/blob/master/README.md)
44

5+
2021-01-19 5.1.0
6+
- Switched to Azure.Extensions.AspNetCore.Configuration.Secrets and Azure.Identity for the Azure Key Vault management
7+
58
2021-01-07 5.0.5
69
- Updated nuget packages 3.1.10
710
- Updated npm packages

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ Use the `-n` or `--name` parameter to change the name of the output created. Thi
8585
- Update the claims in the IdentityWithAdditionalClaimsProfileService
8686
- Add the security headers as required, CSP, IFrame, XSS, HSTS, ...
8787
- If you deploy in a multi instance environment, add the session data to a database using the IdentityServer4.EntityFramework NuGet package
88+
- Add "AZURE_TENANT_ID": "your-tenandId" to the launch settings to test in VS with Azure Key Vault certificates
8889

8990
### uninstall
9091

‎content/IdentityServer4AspNetCoreIdentityTemplate.nuspec‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<package xmlns="http://schemas.microsoft.com/packaging/2012/06/nuspec.xsd">
33
<metadata>
44
<id>IdentityServer4AspNetCoreIdentityTemplate</id>
5-
<version>5.0.6</version>
5+
<version>5.1.0</version>
66
<title>IdentityServer4.Identity.Template</title>
77
<license type="file">LICENSE</license>
88
<description>
@@ -17,7 +17,7 @@
1717
<requireLicenseAcceptance>false</requireLicenseAcceptance>
1818
<copyright>2020 damienbod</copyright>
1919
<summary>This template provides a simle getting started for IdentityServer4 with Identity. Identity is Localized and the UI uses Bootstrap 4, Remove AllowAnonymous from the logout</summary>
20-
<releaseNotes>Updated nuget packages 3.1.9, updated npm packages</releaseNotes>
20+
<releaseNotes>Switched to Azure.Extensions.AspNetCore.Configuration.Secrets and Azure.Identity for the Azure Key Vault management</releaseNotes>
2121
<repository type="git" url="https://github.com/damienbod/IdentityServer4AspNetCoreIdentityTemplate" />
2222
<packageTypes>
2323
<packageType name="Template" />

‎content/StsServerIdentity/Program.cs‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
using System;
2-
using Microsoft.AspNetCore;
2+
using Azure.Identity;
33
using Microsoft.AspNetCore.Hosting;
4-
using Microsoft.Azure.KeyVault;
54
using Microsoft.Azure.Services.AppAuthentication;
65
using Microsoft.Extensions.Configuration;
76
using Microsoft.Extensions.Hosting;
@@ -48,9 +47,7 @@ public static IHostBuilder CreateHostBuilder(string[] args) =>
4847
if (!string.IsNullOrEmpty(keyVaultEndpoint))
4948
{
5049
var azureServiceTokenProvider = new AzureServiceTokenProvider();
51-
var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
52-
53-
config.AddAzureKeyVault(keyVaultEndpoint);
50+
config.AddAzureKeyVault(new Uri(keyVaultEndpoint), new DefaultAzureCredential());
5451
}
5552
else
5653
{

‎content/StsServerIdentity/Services/Certificate/CertificateService.cs‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
using System.Security.Cryptography.X509Certificates;
1+
using Azure.Identity;
2+
using Azure.Security.KeyVault.Certificates;
3+
using Azure.Security.KeyVault.Secrets;
4+
using System;
5+
using System.Security.Cryptography.X509Certificates;
26
using System.Threading.Tasks;
37

48
namespace StsServerIdentity.Services.Certificate
@@ -21,11 +25,20 @@ public static class CertificateService
2125
{
2226
if (!string.IsNullOrEmpty(certificateConfiguration.KeyVaultEndpoint))
2327
{
28+
var credential = new DefaultAzureCredential();
2429
var keyVaultCertificateService = new KeyVaultCertificateService(
2530
certificateConfiguration.KeyVaultEndpoint,
2631
certificateConfiguration.CertificateNameKeyVault);
2732

28-
certs = await keyVaultCertificateService.GetCertificatesFromKeyVault().ConfigureAwait(false);
33+
var secretClient = new SecretClient(
34+
vaultUri: new Uri(certificateConfiguration.KeyVaultEndpoint),
35+
credential);
36+
37+
var certificateClient = new CertificateClient(
38+
vaultUri: new Uri(certificateConfiguration.KeyVaultEndpoint),
39+
credential);
40+
41+
certs = await keyVaultCertificateService.GetCertificatesFromKeyVault(secretClient, certificateClient).ConfigureAwait(false);
2942
}
3043
}
3144

‎content/StsServerIdentity/Services/Certificate/KeyVaultCertificateService.cs‎

Lines changed: 38 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
using System.Linq;
44
using System.Security.Cryptography.X509Certificates;
55
using System.Threading.Tasks;
6-
using Microsoft.Azure.KeyVault;
7-
using Microsoft.Azure.KeyVault.Models;
6+
using Azure.Security.KeyVault.Certificates;
7+
using Azure.Security.KeyVault.Secrets;
88
using Microsoft.Azure.Services.AppAuthentication;
99

1010
namespace StsServerIdentity.Services.Certificate
@@ -25,46 +25,57 @@ public KeyVaultCertificateService(string keyVaultEndpoint, string certificateNam
2525
_certificateName = certificateName; // certificateName
2626
}
2727

28-
public async Task<(X509Certificate2 ActiveCertificate, X509Certificate2 SecondaryCertificate)> GetCertificatesFromKeyVault()
28+
public async Task<(X509Certificate2 ActiveCertificate, X509Certificate2 SecondaryCertificate)> GetCertificatesFromKeyVault(
29+
SecretClient secretClient, CertificateClient certificateClient)
2930
{
30-
(X509Certificate2 ActiveCertificate, X509Certificate2 SecondaryCertificate) certs = (null, null);
31-
var azureServiceTokenProvider = new AzureServiceTokenProvider();
32-
var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
31+
(X509Certificate2 ActiveCertificate, X509Certificate2 SecondaryCertificate) certs = (null, null);
3332

34-
var certificateItems = await GetAllEnabledCertificateVersionsAsync(keyVaultClient);
33+
var certificateItems = GetAllEnabledCertificateVersions(certificateClient);
3534
var item = certificateItems.FirstOrDefault();
3635
if (item != null)
3736
{
38-
certs.ActiveCertificate = await GetCertificateAsync(item.Identifier.Identifier, keyVaultClient);
37+
certs.ActiveCertificate = await GetCertificateAsync(
38+
secretClient, _certificateName, item.Version);
3939
}
4040

4141
if (certificateItems.Count > 1)
4242
{
43-
certs.SecondaryCertificate = await GetCertificateAsync(certificateItems[1].Identifier.Identifier, keyVaultClient);
43+
certs.SecondaryCertificate = await GetCertificateAsync(
44+
secretClient, _certificateName, certificateItems[1].Version);
4445
}
4546

4647
return certs;
4748
}
4849

49-
private async Task<List<CertificateItem>> GetAllEnabledCertificateVersionsAsync(KeyVaultClient keyVaultClient)
50-
{
51-
// Get all the certificate versions (this will also get the currect active version
52-
var certificateVersions = await keyVaultClient.GetCertificateVersionsAsync(_keyVaultEndpoint, _certificateName);
53-
54-
// Find all enabled versions of the certificate and sort them by creation date in decending order
55-
return certificateVersions
56-
.Where(certVersion => certVersion.Attributes.Enabled.HasValue && certVersion.Attributes.Enabled.Value)
57-
.OrderByDescending(certVersion => certVersion.Attributes.Created)
50+
private List<CertificateProperties> GetAllEnabledCertificateVersions(
51+
CertificateClient certificateClient)
52+
{
53+
var certificateVersions = certificateClient.GetPropertiesOfCertificateVersions(_certificateName);
54+
var certificateItems = certificateVersions.ToList();
55+
56+
// Find all enabled versions of the certificate and sort them by creation date in decending order
57+
return certificateVersions
58+
.Where(certVersion => certVersion.Enabled.HasValue && certVersion.Enabled.Value)
59+
.OrderByDescending(certVersion => certVersion.CreatedOn)
5860
.ToList();
59-
}
60-
61-
private async Task<X509Certificate2> GetCertificateAsync(string identitifier, KeyVaultClient keyVaultClient)
62-
{
63-
var certificateVersionBundle = await keyVaultClient.GetCertificateAsync(identitifier);
64-
var certificatePrivateKeySecretBundle = await keyVaultClient.GetSecretAsync(certificateVersionBundle.SecretIdentifier.Identifier);
65-
var privateKeyBytes = Convert.FromBase64String(certificatePrivateKeySecretBundle.Value);
66-
var certificateWithPrivateKey = new X509Certificate2(privateKeyBytes, (string)null, X509KeyStorageFlags.MachineKeySet);
67-
return certificateWithPrivateKey;
61+
}
62+
63+
private async Task<X509Certificate2> GetCertificateAsync(
64+
SecretClient secretClient,
65+
string certName,
66+
string version)
67+
{
68+
// Create a new secret using the secret client.
69+
var secretName = certName;
70+
KeyVaultSecret secret = await secretClient.GetSecretAsync(secretName, version);
71+
72+
var privateKeyBytes = Convert.FromBase64String(secret.Value);
73+
74+
var certificateWithPrivateKey = new X509Certificate2(privateKeyBytes,
75+
(string)null,
76+
X509KeyStorageFlags.MachineKeySet);
77+
78+
return certificateWithPrivateKey;
6879
}
6980

7081
}

‎content/StsServerIdentity/StsServerIdentity.csproj‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,31 @@
11
<Project Sdk="Microsoft.NET.Sdk.Web">
22
<PropertyGroup>
33
<TargetFramework>netcoreapp3.1</TargetFramework>
4-
<Version>5.0.6</Version>
4+
<Version>5.1.0</Version>
55
<Description>IdentityServer4 template with ASP.NET Core 3.1 and ASP.NET Core Identity</Description>
66
<PackageProjectUrl>https://github.com/damienbod/IdentityServer4AspNetCoreIdentityTemplate</PackageProjectUrl>
77
<PackageIconUrl>http://www.gravatar.com/avatar/61d005637f57b5c3da8ba662cf04a9d6.png</PackageIconUrl>
88
<RepositoryUrl>https://github.com/damienbod/IdentityServer4AspNetCoreIdentityTemplate</RepositoryUrl>
99
<PackageLicenseFile>LICENSE</PackageLicenseFile>
1010
<PackageTags>oidc identityserver4 identity aspnetcore</PackageTags>
11-
<PackageReleaseNotes>Updated nuget packages 3.1.9, updated npm packages</PackageReleaseNotes>
11+
<PackageReleaseNotes>Switched to Azure.Extensions.AspNetCore.Configuration.Secrets and Azure.Identity for the Azure Key Vault management</PackageReleaseNotes>
1212
</PropertyGroup>
1313
<ItemGroup>
14-
<PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.1.0" />
14+
<PackageReference Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.0.2" />
15+
<PackageReference Include="Azure.Identity" Version="1.3.0" />
16+
<PackageReference Include="Azure.Security.KeyVault.Certificates" Version="4.1.0" />
17+
<PackageReference Include="Microsoft.Azure.Services.AppAuthentication" Version="1.6.0" />
1518
<PackageReference Include="BuildBundlerMinifier" Version="3.2.449" />
1619
<PackageReference Include="IdentityServer4" Version="4.1.1" />
1720
<PackageReference Include="IdentityServer4.AspNetIdentity" Version="4.1.1" />
18-
<PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" Version="3.1.10" />
19-
<PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="3.1.10" />
20-
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="3.1.10" />
21-
<PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="3.1.10">
21+
<PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" Version="3.1.11" />
22+
<PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="3.1.11" />
23+
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="3.1.11" />
24+
<PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="3.1.11">
2225
<PrivateAssets>all</PrivateAssets>
2326
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
2427
</PackageReference>
25-
<PackageReference Include="Microsoft.Extensions.Configuration.AzureKeyVault" Version="3.1.10" />
26-
<PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="3.1.10" />
28+
<PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="3.1.11" />
2729
<PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="3.1.4" />
2830
<PackageReference Include="Newtonsoft.Json" Version="12.0.3" />
2931
<PackageReference Include="Remotion.Linq" Version="2.2.0" />
@@ -36,7 +38,7 @@
3638
<PackageReference Include="Serilog.Sinks.Console" Version="3.1.1" />
3739
<PackageReference Include="Serilog.Sinks.File" Version="4.1.0" />
3840
<PackageReference Include="Fido2" Version="1.1.0" />
39-
<PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="3.1.10" />
41+
<PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="3.1.11" />
4042
</ItemGroup>
4143

4244
<ItemGroup>

‎content/StsServerIdentity/package-lock.json‎

Lines changed: 57 additions & 57 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎content/StsServerIdentity/wwwroot/js/vendor-validation.min.js‎

Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)